Symfony Releases Security Patch To Fix Expression Parser Denial-of-Service
Symfony has patched a vulnerability in its expression language component that could allow attackers to trigger a process crash via deeply nested input.
Symfony released a security patch for CVE-2026-109449 in the expression parser.
The flaw involves unbounded nesting of expressions. When the parser encounters untrusted input with deeply nested structures, it can lead to a process crash. An attacker can trigger a stack overflow or exhaustion by providing specific, maliciously crafted expressions, causing the application process to terminate unexpectedly. This creates an availability risk for applications that process expressions provided by end-users.
To fix this, the updated parser implementation introduces limits on the depth of expression nesting. These constraints stop the parser from trying to process structures that exceed a safe threshold, which neutralizes the potential for an application crash.
You need to update your projects to the latest versions to incorporate these changes. Security teams and maintainers should review their dependencies to ensure they use a patched version of the Symfony expression language component.
Outdated versions leave applications susceptible to this denial-of-service vector if they permit the evaluation of untrusted expression strings. Update now.